Table REF  shows that we can defend using differentially private SGD (DP-SGD) [1]} with sufficient amounts of Gaussian noise added to all training gradients —\(\text{}\)  but this comes at a tremendous costs in validation accuracy.
In this setting of an optimization-based attack, we also have to contend with another factor: adaptive attacks. An adaptive attack threat model assumes that the attacker is aware of the defense and can optimize their attack w.r.t to this defense. This attack is highlighted in the second column of Table REF . In this work we adapt WitchesBrew to advanced data augmentation by incorporating the data augmentation into the training phase of the clean model used in the attack. This way poisoned data is created based on a model trained to be invariant to these augmentations. We adapt differential privacy as in [2]} by a straight-through estimate, finding it to be mitigated especially well by an adaptive attack.
